You can view all our alerts from this page. Use the filters below to filter by audience type, title and summary and the sort options to sort for the most recently updated or published content.
24 Sep 2021 - Alert status: HIGH
Critical vulnerability in ManageEngine ADSelfService Plus exploited by cyber actors
A vulnerability exists in certain versions of ManageEngine ADSelfService Plus. A cyber actor could exploit this vulnerability to execute arbitrary code, potentially enabling the actor to take control of the vulnerable host. Affected Australian organisations should apply the available security update.
22 Sep 2021 - Alert status: CRITICAL
Critical vulnerability in certain Hikvision products, IP cameras
A critical vulnerability exists in Hikvision products, including IP cameras, which could allow a cyber actor to take full control of the device. Affected Australian customers should apply an appropriate firmware update provided by Hikvision.
16 Sep 2021 - Alert status: CRITICAL
Remote code execution vulnerability present in Open Management Infrastructure, affects certain Microsoft Azure services
A remote code execution vulnerability exists in Open Management Infrastructure, a management agent used in certain Linux-based Microsoft Azure services. Exploitation of this vulnerability could allow a malicious actor to take control of the vulnerable host. Affected organisations should apply the available security update.
16 Sep 2021 - Alert status: HIGH
Remote code execution vulnerability present in the Windows Scripting Engine of Microsoft Windows
A vulnerability exists in a component of Microsoft Windows. A malicious cyber actor could exploit this vulnerability to execute arbitrary code, potentially enabling the actor to take control of the vulnerable host. Affected Australian customers should apply the security update provided by Microsoft.
14 Sep 2021 - Alert status: HIGH
Remote code execution vulnerability present in the MSHTML component of Microsoft Windows
A vulnerability exists in a component of Microsoft Windows. A malicious cyber actor could exploit this vulnerability to execute arbitrary code, potentially enabling the actor to take control of the vulnerable host. At this current time there is no patch available, affected Australian customers should apply the Microsoft recommended workarounds.
Critical vulnerabilities present in certain versions of Apple iOS, macOS and Safari
Vulnerabilities have been identified in certain versions of Apple iOS, macOS and Safari which could allow an actor to install malware or perform other actions on a vulnerable device or computer.
10 Sep 2021 - Alert status: MEDIUM
Suspected user credentials stolen from FortiNet devices leaked online
A malicious cyber actor has leaked a list of suspected user credentials and IP address of the associated FortiNet SSL VPN device the credentials are used for. Organisations should review the patch status and history of internet exposed FortiNet SSL VPN devices and consider performing a password reset for affected users.
01 Sep 2021 - Alert status: HIGH
Remote code execution vulnerability present in certain versions of Atlassian Confluence
A vulnerability exists in certain self-hosted versions of Atlassian Confluence which could allow a malicious cyber actor to execute arbitrary code. Affected organisations should apply the available patch to mitigate this vulnerability.
31 Aug 2021 - Alert status: MEDIUM
Phone and email scammers impersonating the ACSC
The Australian government will NEVER phone you to request access to your computer, or request you to purchase cryptocurrencies or gift cards. If you receive a suspicious phone call, take the caller's details, hang up and contact the company they claim to represent via official communication channels listed on their website. Never call a number provided by the scammer.
30 Aug 2021 - Alert status: MEDIUM
Property-related business email compromise scams rising in Australia
Cybercriminals are targeting the property and real estate sector to conduct business email compromise scams. All parties involved in the buying, selling and leasing of property should be vigilant when communicating via email, particularly during settlement periods.
27 Aug 2021 - Alert status: MEDIUM
Malicious actors deploying Gootkit Loader on Australian Networks
ACSC has observed an increase of Gootkit JavaScript (JS) Loaders on Australian networks.
19 Aug 2021 - Alert status: HIGH
Microsoft Exchange ProxyShell Targeting in Australia
The ACSC has observed targeting of the Microsoft Exchange ProxyShell vulnerability by Malicious actors.
18 Aug 2021 - Alert status: HIGH
Vulnerability Affecting BlackBerry QNX RTOS
BlackBerry has disclosed that its QNX Real Time Operating System is affected by a BadAlloc vulnerability - CVE-2021-22156. QNX is the world’s most prevalent real time operating system.
05 Aug 2021 - Alert status: MEDIUM
LockBit 2.0 ransomware incidents in Australia
ACSC has observed an increase in reporting of LockBit 2.0 ransomware incidents in Australia.
03 Aug 2021 - Alert status: HIGH
SonicWall devices targeted with ransomware utilising stolen credentials
SonicWall devices are being targeted by a malicious cyber actor as targets for ransomware. The ACSC is aware of likely related activity targeting Australian organisations.
12 Jul 2021 - Alert status: HIGH
Kaseya VSA Supply-Chain Ransomware Attack
Patch now available for Kaseya VSA platform.
07 Jul 2021 - Alert status: HIGH
ForgeRock Open AM critical vulnerability
The ACSC has observed active exploitation of a vulnerability in ForgeRock OpenAM (reported as CVE-2021-35464) against a number of Australian organisations. The ACSC strongly recommends organisations urgently apply available patches or workarounds to mitigate the risk of this vulnerability being exploited.
06 Jul 2021 - Alert status: MEDIUM
Cybercriminals targeting construction companies to conduct email scams
Cybercriminals are targeting construction companies to conduct business email compromise scams. All parties to construction projects should be vigilant when emailing about invoices and bank details.
30 Jun 2021 - Alert status: LOW
Microsoft Releases Security Updates for Microsoft Edge Browser
On June 24, 2021 Microsoft released updates for their Edge Browser addressing two vulnerabilities that an attacker could exploit to inject and execute malicious code.
21 Jun 2021 - Alert status: HIGH
Google Releases Security Updates for Chrome Browser
On June 17, 2021 Google released Chrome version 91.0.4472.114 for Windows, Mac, and Linux. The patch notes for this version can be viewed at Chrome Release Note.
13 May 2021 - Alert status: HIGH
Critical vulnerability discovered in HTTP.SYS in Microsoft Windows
A remote code execution vulnerability could enable a malicious cyber actor to compromise vulnerable Microsoft Windows hosts. The ACSC strongly recommends applying available patches.
10 May 2021 - Alert status: HIGH
Multiple high severity vulnerabilities discovered in the Exim mail server
Exim vulnerabilities could enable a malicious cyber actor to compromise vulnerable Exim servers. The ACSC strongly recommends applying available patches.
08 May 2021 - Alert status: HIGH
Avaddon Ransomware
Increase in Avaddon ransomware attacks in Australia.
27 Apr 2021 - Alert status: HIGH
Potential exploitation of Click Studio’s PasswordState software
On 24 April 2021, Australian software company Click Studios announced a compromise of the software update process for their enterprise password management software PasswordState, used by organisations in Australia and globally.
21 Apr 2021 - Alert status: HIGH
Exploitation of Pulse Connect Secure Vulnerabilities
New advice for mitigating Pulse Connect Secure Virtual Private Network (VPN) vulnerabilities
15 Apr 2021 - Alert status: CRITICAL
Exchange server critical vulnerabilities
On 2 March 2021 Microsoft released information regarding multiple exploits being used to compromise instances of Microsoft Exchange Server. Malicious actors are exploiting these vulnerabilities to compromise Microsoft Exchange servers exposed to the internet, enabling access to email accounts and to enable further compromise of the Exchange server and associated networks.
03 Apr 2021 - Alert status: HIGH
APT exploitation of Fortinet Vulnerabilities
Advanced Persistent Threat actors targeting historic Fortinet vulnerabilities
25 Feb 2021 - Alert status: HIGH
Potential Accellion File Transfer Appliance compromise
ACSC identified Australian organisations may have been impacted the Accellion File Transfer Appliance vulnerability and has provided mitigation recommendations.
VMware vCenter Server plugin remote code execution vulnerability (CVE-2021-21972)
The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) advises users of VMware vCenter Server products, including as part of VMware Cloud Foundation, to ensure their systems are promptly patched after the recent disclosure of a new remote code execution vulnerability.
16 Feb 2021 - Alert status: HIGH
Malware targeting Centreon software
ANSSI identifies campaign targeting Centreon system monitoring software
04 Feb 2021 - Alert status: HIGH
SonicWall Breach
SonicWall identified an internal systems breach using a zero-day vulnerability within the SMA 100 series 10.x code.
25 Jan 2021 - Alert status: HIGH
Potential SolarWinds Orion compromise
FireEye identifies global campaign leveraging malicious updates to SolarWinds software.
12 Nov 2020 - Alert status: HIGH
SDBBot targeting health sector
The ACSC has observed increased targeting activity against the Australian health sector by actors using the SDBBot Remote Access Tool (RAT).
30 Oct 2020 - Alert status: HIGH
Sustained targeting of the health sector
The Australian Signals Directorate’s Australian Cyber Security Centre has identified a sustained campaign by sophisticated cybercrime actors impacting the Australian health sector.
01 Oct 2020 - Alert status: HIGH
2019-131a: Emotet malware campaign
The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) has observed an ongoing and widespread campaign of malicious emails designed to spread Emotet across a variety of sectors in the Australian economy, including critical infrastructure providers and government agencies.
22 Sep 2020 - Alert status: HIGH
Netlogon elevation of privilege vulnerability (CVE-2020-1472)
The ACSC is aware of a recently disclosed critical vulnerability in Microsoft Active Directory Domain Controller systems that allows unauthenticated attackers to trivially access administrative credentials.
18 Sep 2020 - Alert status: HIGH
Active exploitation of vulnerable MobileIron products
The ACSC is aware of active exploitation of vulnerabilities in multiple MobileIron products by malicious cyber actors, including sophisticated state-based actors.
16 Sep 2020 - Alert status: HIGH
Copy-paste compromises
The Australian Government is aware of, and responding to, a sustained targeting of Australian governments and companies by a sophisticated state-based actor. The title ‘Copy-paste compromises’ is derived from the actor’s heavy use of tools copied almost identically from open source.
13 Aug 2020 - Alert status: HIGH
Phone scams impersonating Australian businesses and government agencies
Cybercriminals are spoofing Australian mobile numbers and pretending to be from an Australian Government agency, delivery company or business, manipulating the individual to gain access to their device.
02 Aug 2020 - Alert status: CRITICAL
Ransomware targeting Australian aged care and healthcare sectors
ACSC is aware of increasing targeting of healthcare, including hospitals and aged care, by ransomware campaigns undertaken by cyber criminals.
16 Jul 2020 - Alert status: HIGH
Increasing reports of myGov-related SMS and email scams targeting Australians
Be on the lookout for myGov-related SMS and email scams asking you to verify your myGov details.
15 Jul 2020 - Alert status: CRITICAL
Remote code execution vulnerability in Windows DNS (CVE-2020-1350)
On 14 July 2020, Microsoft acknowledged a critical remote code execution vulnerability in Windows Domain Name System (DNS), which could allow an adversary to run arbitrary code.
14 Jul 2020 - Alert status: CRITICAL
Critical vulnerability for SAP NetWeaver Application Server (CVE-2020-6287)
On 13 July 2020 (United States EST), enterprise resource planning provider SAP released a security patches for a critical vulnerability affecting the Java component LM Configuration Wizard within the SAP NetWeaver Application Server.
06 Jul 2020 - Alert status: MEDIUM
TMUI remote code execution vulnerability - CVE-2020-5902
The ACSC advises users of F5’s enterprise and data centre BIG-IP products to ensure their systems are promptly patched after the recent disclosure of new remote code execution vulnerability.
25 May 2020 - Alert status: HIGH
DDoS threats being made against Australian organisations
The Australian Signals Directorate's Australian Cyber Security Centre (ACSC) is aware of a number of Denial of Service (DoS) for ransom threats being made against Australian organisations, primarily in the banking and finance sector.
22 May 2020 - Alert status: HIGH
2019-126: Vulnerable version of Telerik UI being actively exploited by APT actor
The Australian Cyber Security Centre (ACSC) has become aware that Advanced Persistent Threat (APT) actors have been scanning for and attempting exploitation against unpatched versions of Telerik UI for ASP.NET AJAX using publicly available exploits. Successful exploitation could allow an attacker to upload files to the vulnerable server to facilitate further compromise.
COVID-19 malicious cyber activity
Malicious cyber actors are actively targeting individuals and Australian organisations with COVID-19 related scams and phishing emails. These incidents are likely to increase in frequency and severity over the coming weeks and months. This is due, in part, to the ease in which existing scam emails and texts can be modified with a COVID-19 theme.
Active exploitation of vulnerability in Microsoft Internet Information Services
The Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) is aware that sophisticated actors are actively exploiting a deserialisation vulnerability existing in all versions of Microsoft’s Internet Information Services (IIS) using the .NET framework (.NET). The vulnerability exploits the service’s VIEWSTATE parameter to allow for remote code execution by unauthorised users.
20 May 2020 - Alert status: MEDIUM
Summary of Tradecraft Trends for 2019-20
The Australian Cyber Security Centre (ACSC) investigated and responded to numerous cyber security incidents during 2019 and 2020 so far.
08 May 2020 - Alert status: HIGH
Advanced Persistent Threat (APT) actors targeting Australian health sector organisations and COVID-19 essential services
The Australian Signals Directorate’s (ASD) Australian Cyber Security Centre (ACSC) is aware that Advanced Persistent Threat (APT) actors are actively targeting health sector organisations and medical research facilities.
